Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/10/2026, 10:03
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Payload.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Payload.exe
- Size 55KB
- Sample261001-l3cfwsvfnc
- SHA256 5ee02439cd7f893b654bb6d7ea75a1ce4023df8a7fe0a9d249be3775a338610c
- MD5 0f1270d80f1ca33f6526ae5168444856
- SHA1 303b52acd25d9cab8099ded61dfe2a9bf94dac1a
- SHA512 4dc01cc8664110e801afd1f7009b60af6f61b96f569ae47b1976cdf8fa4d1173b03790bc4ccf9b858872a5b881462c91d839f669103948c70bd272037337df82
- SSDEEP 1536:SIv4Dnpe/NoTcwiDESPDywsNMDeXExI3pm5m:X4Dn8ymDRPDywsNMDeXExI3pm
- TLSH T19E432844BFEA4A01E2BD8F3469F645150A34BA63F932EB1F48D568DB53326C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\Windows\CurrentVersion\Run\372702a0ba2bb307f8e1496f65228bbf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .." Payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\372702a0ba2bb307f8e1496f65228bbf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .." Payload.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Payload.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Payload.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe 2192 Payload.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 2192 Payload.exe Token: SeDebugPrivilege 2880 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe Token: 33 2192 Payload.exe Token: SeIncBasePriorityPrivilege 2192 Payload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe" ..1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2880